CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9779
https://notcve.org/view.php?id=CVE-2017-9779
07 Sep 2017 — OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact." El compilador OCaml permite que los atacantes provoquen un impacto sin especificar mediante vectores desconocidos. Este problema es parecido al de CVE-2017-9772 "pero con un impacto mucho menor." • https://github.com/homjxi0e/CVE-2017-9779 •
CVSS: 10.0EPSS: 6%CPEs: 2EXPL: 0CVE-2017-9772 – Gentoo Linux Security Advisory 201710-07
https://notcve.org/view.php?id=CVE-2017-9772
23 Jun 2017 — Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable. Una sanitización insuficiente en las versiones 4.04.0 y 4.04.1 del compilador de OCaml permite que se ejecute código con privilegios elevados en binarios marcados como setuid, estableciendo la variable de entorno CAML_CPLUGINS, CAML_NATIVE_CPLUGINS o CA... • http://www.securityfocus.com/bid/99277 •
CVSS: 9.1EPSS: 2%CPEs: 3EXPL: 0CVE-2015-8869 – ocaml: sizes arguments are sign-extended from 32 to 64 bits
https://notcve.org/view.php?id=CVE-2015-8869
13 Jun 2016 — OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function. OCaml en versiones anteriores a 4.03.0 no maneja correctamente extensiones de firma, lo que permite a atacantes remotos llevar a cabo ataques de desbordamiento de buffer u obtener información sensible según lo demostrado por una cadena larga para la función String.copy. An integer conversio... • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184507.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-194: Unexpected Sign Extension CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0CVE-2012-0839
https://notcve.org/view.php?id=CVE-2012-0839
08 Feb 2012 — OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. oCaml v3.12.1 y anteriores calcula los valores de hash sin restringir la capacidad para activar las colisiones hash predecibles, lo que permite a atacantes dependientes de contexto causar una denegación de servicio (consumo de CPU) a través ... • http://openwall.com/lists/oss-security/2012/02/07/1 • CWE-20: Improper Input Validation •